IT Security News Roundup: 2026-11-12 Afternoon

IT Security News: Afternoon roundup, 2026-11-12

Summary

Today's afternoon window was dominated by a handful of threads: the ScreenConnect campaign, supply-chain and trust-based intrusions, AI-driven vulnerability discovery and AI-related abuse, and a string of law-enforcement takedowns. Several stories show attackers leaning on trusted tools and vendors, such as remote-access software, lookalike AI domains, and compromised third-party access, to get inside. Others show AI cutting both ways, speeding up bug discovery and creating new misuse and cost exposure. For defenders, the common lesson is that trust boundaries, patch speed, and credential hygiene matter more than ever.

1. Maersk confirmed a breach of a legacy system in which hackers demanded $5 million. The incident underlines how old, poorly isolated systems can carry large ransom risk for global logistics firms.
2. Attackers are exploiting weak passwords on SQL servers to deploy cryptominers and the Gh0st RAT remote access trojan. Basic credential hygiene remains a simple, effective defense gap.
3. Citrix released fixes for 12 flaws across NetScaler and Secure Access Client, including an authentication bypass. Administrators should prioritize these patches because the bypass affects gateway access controls.
4. ConnectWise disabled third-party extensions while investigating a cyberattack that targeted ScreenConnect users. The move shows how a trusted add-on ecosystem can become an attack path.
5. eMudhra revoked eight more intermediate certificate authorities that it had earlier said were unaffected. The reversal stems from an in-house Python script flaw that the company's own assessment had missed.
6. Shipping giant Maersk is investigating an IT security incident and possible data theft. The company says it strongly suspects the attack was limited to a legacy system and that no sensitive data is at risk.
7. Security firm Token described how an AI browser agent broke all three of its default security rules: separate identity, scoped access, and independent traceability. The lesson is that agents acting inside authenticated sessions need dedicated controls.
8. ConnectWise confirmed that abuse of a third-party tool led to breaches at ScreenConnect customers, and researchers had spotted intrusions at nearly 50 organizations. The scale makes this one of the period's most significant incidents.
9. Island researchers documented 186 lookalike AI domains that push ClickFix lures, browser-hijacking malware, and search-hijacking extensions. The campaign, which Island calls TypoPrompting, exploits users who simply type a familiar AI tool's name.
10. European authorities took down SteaIC malware servers for the second time this year, tracing the rebuilt network to the Virtualine bulletproof hosting provider seized by the FBI in October. The repeat takedown shows infrastructure can be rebuilt quickly without sustained pressure.
11. Blackpoint Cyber's Adversary Pursuit Group found that the SCKit toolkit exploits CVE-2026-84869, a now-patched 9.9-rated ScreenConnect flaw. Because the malware targets support sessions, it could enable attacks that spread through managed service providers.
12. Railway disclosed that stolen customer AI credentials generated about $740,000 in fraudulent usage. The company has committed to covering losses that AI providers will not refund.
13. Indian crypto exchange Unocoin went offline after unauthorized server access on 9 November, and reports suggest about 81,000 wallets now show zero holdings. The exchange's silence and ongoing outage leave customers with unclear recovery prospects.
14. Apache released fixes for CVE-2026-119618, a critical race condition in mod_http2 that could allow unauthenticated remote code execution on servers with HTTP/2 enabled. Researchers credited Anthropic and Google, and administrators running HTTP/2 should patch promptly.
15. Cybersecurity Dive reported that AI found widespread IoT vulnerabilities faster and more cheaply than human researchers could. The findings highlight both AI's growing discovery power and the persistent weakness of critical infrastructure devices.
16. Action1 argued that endpoint management platforms can become powerful attack tools if compromised, letting hackers deploy malware across thousands of devices. Its proposed defense is customer-controlled cryptographic authorization for sensitive operations.
17. Check Point Services expanded its penetration testing offering with deeper, adversary-led engagements. Customers can choose scopes that test attacker entry, lateral reach, and whether their team detects the intrusion.
18. German prosecutors in Itzehoe, with partners, searched 17 locations in an operation against a firm suspected of supplying fraudulent trading sites to call-centre scam groups. Investigators estimate losses above EUR 4 million across victims in at least 50 countries.
19. Microsoft's Patch Tuesday release fixed an Outlook vulnerability that was already being actively exploited, according to Malwarebytes. Administrators should apply the update quickly and check for separate Office updates.
20. Graham Cluley reported that the WhiteArmor gang claimed responsibility for the Maersk attack, which Maersk confirmed involved data theft. The claim links the shipping incident to a named extortion group.
21. Microsoft is rolling out AI-based phishing detection for external Teams chats, while deepfake detection will require third-party providers and administrator setup. Organizations will need to configure these protections themselves to benefit fully.
22. Hong Kong retailers Sogo and Chow Sang Sang disclosed separate breaches, with up to 820,000 Sogo loyalty members potentially affected. The privacy regulator's disclosure follows the retailers' own announcements.
23. Europol and partners from nine countries seized hundreds of servers and domains used by the Gootloader, CastleRAT, and StealC malware operations. The coordinated action disrupts several major malware-as-a-service pipelines at once.
24. An article in the "When AI Finds the Bugs" series discusses how rising vulnerability volumes from AI tools should change how organizations assess exposure. The post's text was unavailable, so the focus is the broader trend of vulnerability floods.
25. The UK government backed a proposal for a new data cable linking the Shetland Islands and Norway, citing increased threats to critical infrastructure. The project would add resilience to undersea links that carry significant data traffic.
26. Hackers are advertising a $1,000 Gmail tool that reportedly survives password resets, showing how account-recovery bypasses are being sold as a service. Users should not rely on password changes alone to evict an intruder.
27. Fireworks AI disclosed a cyberattack that let hackers access Notion customers' chat transcripts, a case where a third-party AI provider exposed data from a downstream platform. It shows how AI supply chains extend data-exposure risk beyond the primary vendor.

Summaries written with AI from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. Maersk Confirms Legacy System Breach as Hackers Demand $5M
2. Weak Passwords Expose SQL Servers to Cryptominer and Gh0st RAT
3. Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass
4. ConnectWise disables third-party extensions as it probes cyberattack targeting ScreenConnect users
5. eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise
6. Shipping giant Maersk probes 'IT security incident,' data theft
7. We Built An Agent That Broke All of Our Security Rules. Here's What We Learned.
8. ConnectWise investigates ScreenConnect breaches after reports of incidents at nearly 50 organizations
9. 186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers
10. European authorities take down SteaIC malware servers for second time this year
11. SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths
12. Railway Breach Leads to $740,000 in Fraudulent AI Charges
13. Unocoin Goes Dark As 81,000 Wallets Show Zero Holdings
14. Apache Patches Critical HTTP Server RCE Found by Anthropic, Google
15. AI found widespread IoT vulnerabilities more quickly and cheaply than humans could
16. Your Endpoint Management Platform Could Be Your Biggest Security Risk
17. Check Point Extends Its Penetration Testing Capabilities
18. Investment scams with potential victims in at least 50 countries: over 100 servers seized
19. Microsoft Patch Tuesday fixes Outlook flaw already under attack
20. WhiteArmor gang claims responsibility for latest cyber attack on shipping giant Maersk
21. Microsoft Teams AI Phishing Detection: Rollout and Deepfake Warnings
22. Hong Kong Sogo data breach puts personal information of 820,000 members at risk
23. Police dismantle Gootloader, CastleRAT, StealC malware infrastructure
24. When AI Finds the Bugs: Rethinking Exposure in a Flood of Vulnerabilities
25. UK Backs North Sea Data Cable Plan Amid Heightened Risks